Google releases Cloud-based Web App Vulnerability Scanner and Assessment Tool

Google on Thursday unleashed its own free web application vulnerability scanner tool, which the search engine giant calls Google Cloud Security Scanner, that will potentially scan developers' applications for common security vulnerabilities on its cloud platform more effectively. SCANNER ADDRESSE...

eYou mail system The message body stored XSS（HTML5 features and need to click on the-vulnerability warning-the black bar safety net

Since eyou version number is different, the following test code The effect is a subtle distinction, but the presence of the vulnerability causes of the same. Test code: !-- if trueimg onerror=alert1 src=--form action=javascript:alert2input type=submitinput autofocus onfocus=alert3select autofocus...

WebRTC Found Leaking Local IP Addresses

A recently publicized hole in WebRTC, a protocol for web communication, is revealing the local IP addresses of users, even those who go to extra lengths to hide theirs by using a virtual private network. Daniel Roesler, a San Francisco-based researcher who’s dabbled in encryption, posted a...

WordPress /wp-content/plugins/html5-mp3-player-with-playlist/html5plus/playlist.php 信息泄露漏洞

No description provided by source...

chromium-browser: caching error in AppCache

The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcacheupdatejob.cc in Google Chrome before 40.0.2214.91 proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5...

Oracle Fusion Middleware Security Service Information Disclosure (January 2015 CPU) (BEAST)

The version of Oracle HTTP Server installed on the remote host is affected by an information disclosure vulnerability, known as BEAST, in the SSL 3.0 and TLS 1.0 protocols due to a flaw in the way the initialization vector IV is selected when operating in cipher-block chaining CBC modes. A...

Google Chrome SSL Certificate Validation Vulnerability

Google Chrome is a popular WEB browser. A certificate validation vulnerability exists in Google Chrome SSL that allows attackers to conduct AppCache caching of SSL sessions to spoof HTML5 application content...

CVE-2014-7948

The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcacheupdatejob.cc in Google Chrome before 40.0.2214.91 proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5...

CVE-2014-7948

The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcacheupdatejob.cc in Google Chrome before 40.0.2214.91 proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5...

UBUNTU-CVE-2014-7948

The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcacheupdatejob.cc in Google Chrome before 40.0.2214.91 proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5...

TechSmith Camtasia 7 / 8 Cross Site Scripting

Title: Reflected XSS in Flash files of TechSmith Camtasia 8 & 7 Author: Soroush Dalili @irsdl Affected Software: TechSmith Camtasia v8.4.4 latest 8.x & v7.1.1 latest 7.x Vendor URL: http://www.techsmith.com/camtasia-version-history.html Vendor Status: vulnerable CVE-ID: - Camtasia 8 v8.4.4 latest...

WordPress Html5 Mp3 Player 'playlist.php' Path Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

CVE-2014-8025

The API in the Guest Server in Cisco Jabber, when HTML5 is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST response, aka Bug ID CSCus19801...

Design/Logic Flaw

The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST request, aka Bug ID CSCus19789...

CVE-2014-8025

The API in the Guest Server in Cisco Jabber, when HTML5 is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST response, aka Bug ID CSCus19801...

CVE-2014-8024

The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST request, aka Bug ID CSCus19789...

CVE-2014-8025

The Cisco advisory (Cisco Jabber Guest Server HTML5) describes a vulnerability in the Guest Server where missing encryption on sensitive data sent via HTTP GET/POST can be sniffed by an unauthenticated remote attacker to disclose information. Exploitation requires access to the network segment wh...

CVE-2014-1592

Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document duri...

CVE-2014-1592

Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document duri...

FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09)

The Mozilla Project reports : ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer...